CVE-2017-5637

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Published: Oct 10, 2017
Updated: Nov 8, 2023
CVE: CVE-2017-5637
GHSA: GHSA-7cwj-j333-x7f7
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

Affected Software
References

Software	From	Fixed in
apache / zookeeper	3.5.0	3.5.0.x
apache / zookeeper	3.5.2	3.5.2.x
apache / zookeeper	3.5.1	3.5.1.x
apache / zookeeper	3.4.9	3.4.9.x
apache / zookeeper	3.4.8	3.4.8.x
apache / zookeeper	3.4.7	3.4.7.x
apache / zookeeper	3.4.6	3.4.6.x
apache / zookeeper	3.4.5	3.4.5.x
apache / zookeeper	3.4.4	3.4.4.x
apache / zookeeper	3.4.3	3.4.3.x
apache / zookeeper	3.4.2	3.4.2.x
apache / zookeeper	3.4.1	3.4.1.x
apache / zookeeper	3.4.0	3.4.0.x
debian / debian_linux	8.0	8.0.x
org.apache.zookeeper / zookeeper	3.4.0	3.4.10
org.apache.zookeeper / zookeeper	3.5.0	3.5.3

Vulnerability Database

289,599

CVE-2017-5637